CVE-2024-38207: Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVE-2024-38207 is an edge - chromium vulnerability in Microsoft Edge (HTML-based), rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.3 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.40% probability of exploitation activity in the next 30 days, higher than 34% of all scored vulnerabilities. Microsoft released the fix on 22 August 2024, outside Patch Tuesday. It affects 1 product in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2024-38207
- Severity
- Medium CVSS 6.3
- Microsoft severity
- Moderate
- Impact
- Edge - Chromium
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-843; CWE-787
- EPSS
- 0.40% (percentile 34%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2024 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2024-38207 at 6.3 (temporal 5.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | Low |
| Integrity impact | Low |
| Availability impact | Low |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
According to the CVSS metrics, successful exploitation of this vulnerability could lead to minor loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability?
While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker would need to combine this with other vulnerabilities to perform an attack.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted URL to be compromised by the attacker.
What is the version information for this release?
Microsoft Edge Channel
Microsoft Edge Version
Based on Chromium Version
Date Released
Stable
128.0.2739.42
128.0.6613.84/.85
8/22/2024
According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?
Successful exploitation of this vulnerability requires requires the victim to click a malicious link for an attacker to initiate remote code execution of valid opcodes.
Affected products (1)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Edge (Chromium-based) | Release Notes | Security Update | 128.0.2739.42 | No |
NIST NVD data
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| edge chromium | before 128.0.2739.42 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38207 (Patch, Vendor Advisory)
Acknowledgments
- Nan Wang(@eternalsakura13)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Updated CWE value. This is an informational change only. |